Non-Interactive Auth Followed by Bulk Data Download

14 NI Auth Bulk Data Download

Query

let SilentAuthUsers =
    AADNonInteractiveUserSignInLogs
    | invoke ExcludeAllowlistedIPs_AADNI()
    | where TimeGenerated > ago(2h)
    | where ResultType == 0
    | summarize SilentSignIns = count(), LastNI = max(TimeGenerated)
      by UserPrincipalName;
OfficeActivity
| where TimeGenerated > ago(2h)
| where Operation in (
    "FileDownloaded", "FileSyncDownloadedFull",
    "SearchQueryPerformed", "FileAccessed"
  )
// Suppress activity from trusted/allowlisted IPs. The download ClientIP must be
// checked too - filtering only the silent-auth IP still lets downloads from an
// allowlisted IP trigger the rule.
| extend IPAddress = ClientIP
| invoke ExcludeAllowlistedIPs_AADNI()
| summarize
    OpCount    = count(),
    FileCount  = dcount(SourceFileName),
    Operations = make_set(Operation),
    ClientIP   = tostring(make_set(ClientIP)[0])
  by UserId
| where OpCount > 150
| join kind=inner SilentAuthUsers on $left.UserId == $right.UserPrincipalName
| project
    UserPrincipalName = UserId,
    OperationCount    = OpCount,
    UniqueFiles       = FileCount,
    Operations,
    SilentSignIns,
    ClientIP
| order by OperationCount desc

Explanation

This query is designed to detect potential data exfiltration activities in a Microsoft environment, specifically focusing on SharePoint and OneDrive. Here's a simplified breakdown:

Purpose: The query identifies when a user silently refreshes an OAuth token (a type of non-interactive authentication) and then performs a large number of file downloads or accesses within a short time frame. This behavior might indicate that an application with persistent access is being used to exfiltrate data.
Data Sources: It uses logs from Azure Active Directory (AAD) to track non-interactive sign-ins and logs from Office 365 to monitor file activities.
Detection Logic:
- It first identifies users who have recently performed a silent authentication (non-interactive sign-in) within the last two hours.
- It then checks for users who have performed more than 150 file-related operations (like downloading or accessing files) in SharePoint or OneDrive within the same time frame.
- It excludes activities from trusted IP addresses to reduce false positives.
Alerting: If such behavior is detected, an alert is generated. The alert includes details like the number of operations performed, the number of unique files accessed, and the IP address from which the operations were performed.
Severity and Response: The severity of this alert is marked as high, indicating a significant risk of data exfiltration. If triggered, it creates an incident for further investigation.
MITRE ATT&CK Techniques: The query is aligned with specific MITRE ATT&CK techniques related to data exfiltration and collection, namely T1048 and T1213. Overall, this query helps security teams identify and respond to potential unauthorized data transfers, ensuring sensitive information is protected from being leaked.

Details

David Alonso

Released: July 16, 2026

Tables

AADNonInteractiveUserSignInLogsOfficeActivity

Keywords

AzureActiveDirectoryAADNonInteractiveUserSignInLogsOffice365OfficeActivityUserPrincipalNameClientIPUserIdSourceFileNameSharePointOneDrive

Operators

letinvokewheresummarizebyinextendjoinonprojectorder bydescagomaxcountdcountmake_settostring

Severity

High

Tactics

ExfiltrationCollection

MITRE Techniques

T1048 T1213

Frequency: 1h

Period: 2h

Actions

GitHub

KQL Search